More Criticals, Less Dopamine

Finding bugs used to be the best part of the job. Somewhere along the way, that changed.

Just spawned Codex in the background. I’m hoping I will land a critical by the time I finish writing this.

The Job Has Changed

It was a normal day. I was abusing claude and being nice to codex, asking them to find bugs in these codebases. Then, at some point, I stopped and thought: What the hell am I doing?

The majority of the work used to be digging deep into the code, tracing manually, looking for something suspicious, and digging until I understood whether it could be used to do nasty stuff.

Now, even reading the code often feels secondary. An LLM does much of the analysis, points me toward the interesting paths, and sometimes produces a proof of concept before I have properly opened the relevant files. Half the time, I do not need to read code at all. I can ask for a PoC, test it from the outside, and confirm the vulnerability. I just have to make sure it didn’t cheat.

I have not done manual deep code review for months. Unless you are looking at an absolutely massive codebase or a very complex system, you can mostly run a frontier model, ask the right questions and complete the code review by just chatting with the LLM.

One thing I can say for sure- the pure dopamine hit of finding a vulnerability is mostly gone. The models now do the heavy lifting of what used to be the most exciting part of the work. I’m finding more severe bugs than ever but the satisfaction just isn’t there.

Constantly catching up to the model upgrades, switching between the models, and abusing/praising LLMs all the time, and when it finally finds something, being a triager and validating it. This is what the job has become.

Ive been triaging for a very long time. Everyone who’s done it for a sufficiently long time will always choose being a vulnerability finder over being a triager. But now triage is the entire job for both sides.

Hacking is now a where and what question. The how still matters, you just don’t execute it anymore. You check it.

Just Stop Using LLMs?

Why dont i just stop using llms? Machines are better at chess than humans. But humans still play chess, right?

Well, yea. But do you see people riding a horse to work? No? Yea, that’s the point.

Art, games, and hobbies are things that come from being human. Much of their value is derived from the person doing them. But vulnerability research doesn’t care about whether you found it or a machine did. The affected system is equally vulnerable either way.

If you love the process more than results, you can always do it the traditional way. However, the race to that 0-day doesn’t care about the process.

Vuln Research Isn’t Dead

Am i trying to say vuln research is dead? Definitely not. The number of vulnerabilities being found right now is at an all-time high. And if you look around, all the people finding these massive bugs are the same people who were doing exceptional work before the current AI boom.

The numbers have increased, the severity has increased, but at the end of the day it’s mostly the same people finding cool stuff.

What im saying is the pre-AI way of working is dead. If you are still in denial and not using ai to do the heavy lifting, you are leaving a lot on the table.

Codex says we have a crit. Will validate after wrapping up this blog.

Two Ways Forward

I want to keep doing vulnerability research. But, I want to do something more than just abusing llms and hoping they pop a shell.

I’m not going to predict what will happen in the years to come. Speaking of the present, from what I see, there are two ways forward.

The first is the super engineer. If the model does the analysis, the leverage moves to everything around the model: the harness, the orchestration, the validation pipeline.

The second is the super researcher. Discovering a new vulnerability class, thinking beyond a single bug, or digging into the intersection of AI and security to get the most out of the models and push the frontier and redefine what’s possible.

I tried getting my hands dirty on both. Over the past couple of months, I built a tool to automate wordpress vulnerability research, and published a research paper.

Doing them brought back a joy that had started to wear off from just abusing and praising LLMs to find bugs.

Hamming’s Question

Somewhere in the middle of all this transition, I read The Art of Doing Science and Engineering by Richard Hamming.

He asks a great question in it. What are the important problems in your field, and why aren’t you working on them?

With most of the comfort zone being taken away, I finally have the time to sit with that question. What’s worth working on, and what I was working on because it was in front of me.

Maybe a reset this big is the only time you get to change what you’re pointed at without it costing you anything.

After going through the five stages of grief some time ago, I view all of it as a once-in-a-lifetime opportunity. The floor has been raised for everyone.

Everyone has the intelligence at their disposal. What separates the best from the rest is the problem they choose to work on.

What a time to be alive!

Confirmed the crit.